Stated in the datasheets of every manufactor for the 555 Series (believe me, you can easily google them) the fastest switching time for a SE555 is 100ns. This is best case scenario. So this little sweet high speed counter is way out of business to switch in 40ns.

thank you, that's what i've been saying.. I also believe I made a working rig that will pulse for 63ns however I am having trouble soldering the rambus.

Believe me, 555 is not gonna work because it's pulsing high to ram bus and messing ram content. Xorloser solution is working because he is changing micro controller pin state output to input thus nothing interrupt ram bus except low pulse. It's working like relay in his case.

If you have a problem with soldering find end of ram bus trace you'll see blue resistor (at 20 or 60 GB) or little circle (at 80 GB) and scratch paint with razor, clean it with soft cloth, put solder paste on it and try to put little bit solder on it without cable. If you did successfully you can solder cable easily. Don't try to solder cable to trace this can destroy your trace if you didn't care enough.

alternatives

I think using some cheap uC (example attiny44) would work better. The a attiny24/44/84 has a speed around 20MIPS @ 20MHz (mostly 1 instruction per clock) but the best thing, it only require some resistor and an LPT port to program .. So it only has a speed of 50ns / clock (50ns/instruction) with 20MHz crystal, BUT maybe working with faster crystals.

And a little about the program, what has to be done:
-set data dir to input and port to 0 (low -- then it's in Hi-Z mode) (the pin connected to the ps3)
-loop until button push (other pin, input.. etc)
-set data dir to output, and then back to input (the "ps3 pin") (that's why the port 0)
-wait around 0,5-1 sec (to prevent multiple triggering)
-goto to loop (to be able to send signal again)

The cicrcuit should run on 5V, witch can be extracted from the usb port of the PS3 or of course from external source, but don't forget to connect the gounds

Notes:
- to program, you have to power up the ic externally !!!BUT connect the programmer first, then power the device!!! (otherwise you can kill your LPT port)
- if you set the clk to external crystal, you have to use it during programming
- you have to set the fuses to use external crystal, and other settings (don't worry, these can be altered... not so the lock bits, so don't tamper with them)

I'm not here to advertise avr, but 555 with RLC? Come on... even logic gates works faster... and reliable

Well, Geo has been not so clear in his explanation but assuming the pulse low is to be intended as a single cycle it should mean the pulse must be 25Mhz to last 40ns, what I'm wondering about is why this timing when the rambus clocks is 3,2Ghz probably made by 4x800Mhz of initial clock ?

Why not a single 1,25ns 1,8V pulse ?

Did he explained this to someone ?

Quarz@800Mhz do exists, maybe an high frequency oscillator could do the job if stuffed in order to output what we want... (I'm not specially skillfull in this field, so please, do not ask too much out of me.. just an idea to someone else..)

Well, Geo has been not so clear in his explanation but assuming the pulse low is to be intended as a single cycle it should mean the pulse must be 25Mhz to last 40ns, what I'm wondering about is why this timing when the rambus clocks is 3,2Ghz probably made by 4x800Mhz of initial clock ?

Well, if you read his earlier attempts, he's written more about the mechanism: something like allocating a big chunk of memory, and during that, tampering with the wires, make the instruction to address other parts of the memory, witch you should't have access to. And doing so, it doesn't requre that 'insane' speed due to big arrays. (you need only 1 exploitable address out of 0x100000)

On the other hand, it's not a rock-solid solution (need some/lot of try to get to work), so i think it is not impossible to achive the glitch with longer or sorter pulse..

To tell it all I think that shortening the memory bus to ground for a shorter time could lead to the same results but with less troubles IF, a big IF the whole system shouldn't cook itself up in the try...

The point is to obtain the MMU could return an error code to HV stopping him from returning the invalid address routine cause he doesn't know how to do in that occurrence and freeing this way the target address, am I right , am I ?

Or to have the MMU could NOT to return anything to the HV, obtaining the same thing ?

I'm just trying to focus... sorry for the silly questions but I didn't had the time to read all the IBM things...